Add UUID to spdxIds in example data

[bact]

• Use https://spdx.org/spdxdocs/ prefix, as found in many examples in https://github.com/spdx/spdx-examples/
• Add UUID to the ID

Update 24 Apr 2026: Use spdxId as suggested in the newly updated spdxId description (see https://spdx.github.io/spdx-spec/v3.1-dev/model/Core/Properties/spdxId/ - revised by spdx/spdx-3-model#1215)

To fix #1323

[maxhbr]

is the https://spdx.org/spdxdocs/... prefix to IDs what we expect third-parties to do? Do we have guidance on that?

[bact]

is the https://spdx.org/spdxdocs/... prefix to IDs what we expect third-parties to do? Do we have guidance on that?

From SPDX 2.3 spec,
https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#652-intent :

A best practice for creating the URI for SPDX documents available on the public internet is https://[CreatorWebsite]/[pathToSpdx]/[DocumentName]-[UUID] ...

If the creator does not own their own website, a default SPDX CreatorWebsite and PathToSpdx can be used spdx.org/spdxdocs. Note that the SPDX documents are not currently stored or accessible on this website. The URI is only used to create a unique ID following the above conventions.

However, I don't think we have that written in 3.0 spec. The closest thing we have is probably an example in "Getting Started" guide, hosted in the using repo: https://spdx.github.io/using/getting-started/

I think it will benefit spec readers and implementers if we have this written somewhere in 3.0 spec. (Keith raised this spdxId schema question as well during Implementers call on 5 Jan 2026)

[bact]

[Off-topic] Looking at SPDX 2.x specs, I really like the way they have the Purpose and Intent sections for every fields. They are very useful and can help spec readers, including implementers, understand the design choices. We tend to have those explanations in issues and PRs of spdx-spec and spdx-3-model repos, meeting minutes, and mailing list, but not in one single structured place like in 2.x.

[zvr]

I suggest we use https://spdx.org/example-data/... for identifiers in our examples.

[maxhbr]

But what is the guidance for a tool vendor. Should they write

• https://spdx.org/example-data/...
• https://spdx.org/${tool-name}-document/...
• https://tool-vendor.com/spdx-document/...
• urn:....

I think that us using the example-data here creates confusing examples which can not easily be transferred to something a tool would create. They are hand-curated and hand-build examples which makes them even more unrealistic. I saw developers struggling with the task "what to write in the spdxid field".

[maxhbr]

I think a recommended "if not sure use the following way of generating spdx ids" would be great

[zvr]

... and so on.

Essentially, use https://spdx.org/example-data/ as prefix.

[zvr]

I think a recommended "if not sure use the following way of generating spdx ids" would be great

I completely agree, but this is a separate point from the actual example data file.

[kestewart]

DIscussed on call. Agreed to move to -rc2. Need feedback from Max.

[bact]

Apparently, this issue is not new:

• annexes: getting started: Fix SPDX IDs #964

[bact]

To update changes to reflect the recently updated spdxId (updated by PR spdx/spdx-3-model#1215).

[bact]

I have updated the spdxId in both examples to the format suggested in the newly updated spdxId description.

Note that # is removed from spdxId of SpdxDocument, to follow the suggestion above.

@maxhbr @zvr @JPEWdev @goneall please review.

(if we don't want to use https://spdx.org/spdxdocs/..., I think we can also use the URL that based on the actual path, for example, https://spdx.github.io/spdx-spec/v3.1/examples/jsonld/spdx-full-example.json/... - if we decided to publish these examples on https://spdx.github.io/spdx-spec/v3.1/ -- the spdx-full-example.json already use something close to this convention)

[goneall]

Discussed on 21 July 2026 Tech call - we'll go ahead and approve/merge for now - if we want a shorter version, we can do a separate PR

[goneall]

@zvr - any concern with just merging this PR and creating a separate PR if we want a shorter / different ID approach?

Change requests are addressed and requested for re-review. No response in the past four months. Will reset this and request for review again.